Proactive Daily Planner

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 11:30 PM UTC
• Version: 0.2.0

Overview

This appears to be a normal daily planner skill that saves local plan files and only suggests optional scheduling, with no evidence of hidden network, destructive, or deceptive behavior.

Before installing, understand that this skill can save daily planning notes under your OpenClaw memory directory. Only add the suggested cron or HEARTBEAT automation if you want recurring runs, and periodically delete or protect saved plan files if they contain sensitive personal or work details.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly encourages scheduled automatic execution and documents persistent storage of daily plans, task history, and progress statistics, but it does not clearly warn users that the skill will continuously write behavioral data to disk over time. In a personal assistant context, this can expose sensitive routines, productivity patterns, and personal notes to other local users, backups, or downstream tools, especially when automation is enabled via cron or heartbeat integration.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation indicates shell and environment-related capabilities through installation/usage commands and filesystem data storage, but it declares no explicit tool scope such as allowed-tools or permissions. This creates an authorization ambiguity where an agent or platform may grant broader execution capability than users expect, increasing the risk of unintended command execution or access to local data.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill describes proactive and automatic behavior but does not define precise trigger conditions, rate limits, or boundaries on what actions it may take when activated. Ambiguous auto-triggering can cause the agent to run unexpectedly, access user context too broadly, or initiate repeated actions without meaningful user consent.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The statement that the skill runs automatically based on a schedule lacks constraints around scope, duration, and permitted actions during scheduled execution. In a proactive assistant context, this is risky because recurring autonomous runs could repeatedly access memory files, send notifications, or invoke other integrated skills without sufficiently bounded authorization.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill description is broad enough that the agent may activate in situations beyond simple daily planning, increasing the chance of unsolicited proactive behavior or access to user context not strictly needed for the task. In a proactive assistant, vague scope is more dangerous because the design already encourages autonomous check-ins and planning actions throughout the day.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The manifest describes a proactive daily planning assistant, which suggests generating guidance and organizing tasks, but this implementation also persists content directly to the user's filesystem. Local file writing is a materially broader operation than purely assisting via planning dialogue, and it is not disclosed in the manifest description.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "  Add to your HEARTBEAT.md or create a cron job"
echo ""
echo "💡 Pro tip: Set up a daily reminder:"
echo "  crontab -e"
echo "  # Add: 0 8 * * * cd $INSTALL_DIR && node planner.js morning"
echo "  # Add: 0 13 * * * cd $INSTALL_DIR && node planner.js progress"
echo "  # Add: 0 20 * * * cd $INSTALL_DIR && node planner.js evening"

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: Natural-language policy checks apply to all file types. Setting the user's timezone to a fixed locale-related value can impose a locale preference without opt-in, and the file does not indicate that the user can choose or override this setting.

Vague Triggers

Low

• Confidence: 91% confidence
• Finding: The package description advertises a broadly proactive personal-assistant capability without defining concrete trigger phrases, invocation scope, or user-consent boundaries. In an agent ecosystem, this can cause overbroad activation or invocation in contexts beyond simple planning, increasing the chance of unintended access to user context or actions.

Context-Inappropriate Capability

Low

• Confidence: 89% confidence
• Finding: A proactive daily planner does not need shell-command execution to organize a day, track tasks, or provide motivation. Even though execSync is not used elsewhere in this file, including child process capability is unjustified by the declared purpose and expands the available attack surface.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The code hard-codes `en-US` for weekday and time formatting, which imposes a specific locale on all users regardless of preference. This is a natural-language/locale policy concern because the skill does not offer any locale choice or explain why a U.S. English format is required.

Static analysis

No suspicious patterns detected.